You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
hotato contract unpack --force no longer deletes the existing output
directory before the archive has proven valid. In 0.6.0 and 0.7.0, a
corrupt or hostile archive combined with --force destroyed the
directory the user asked to replace and then failed. The destination is
now touched only on the success path, after every guard and the full
extraction into the temporary directory have passed. Found by external
diligence against the published package; regression-tested with the
exact reproduction.